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[57] ABSTRACT 

A method of creating a self-documenting logfile which 
records the status and operation of a substantially com- 
puter-controlled device. The method comprises the 
steps of accepting input commands from a user for con- 
trolling the device status and operation; monitoring the 
device characteristics; detecting deviations in the de- 
vice status, user inputs, and procedural steps in the 
device's operation; writing these detected events to the 
logfile with the date and time of which the detected 
event occurred; and retrieving the logfile upon user 
demands for review of the logfile. In order to comply 
with good laboratory practices (GLP), the method 
additionally comprises steps for verifying the user input 
commands by determining the acceptability of the input 
commands, detecting inadvertent alteration to the log- 
file and testing the validity of the logfile for invalid 
data. Steps for providing an enciphering key within the 
event lines which comprise the logfile in order to detect 
tampering are also disclosed. 

22 Claims, 10 Drawing Sheets 
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condition, such as temperaiure, and convey ihts infor- 

SELF DOCUM ENTI NG RECORD OF mation to a computer or other processor so that it mav 

INSTRUMENT ACnVITY AND ERROR be displayed on a display screen. Examples of suitable 

MESSAGES STAMPED WITH DATE AND TIME sensors are pressure sensors, optical sensors of quanlifi- 

OF OCCURRENCE 5 able parameters such as absorption, transmittance and 

fluorescence, and electrodes which detect changes in, 

RELATED APPLICATION DATA for example, pH and electric potential. 

This application is related to the subject matter of Likewise, for modification of an operating parameter 

commonly assigned co*pending U.S. patent application to be implemented in the operation of the mechanical 

Ser. No. 487,548 entitled "Image-oriented Method and device, an actuation means must be present in that me- 

Apparatus for Computer Control of Mechanical De- chanical device to drive the device to the new, selected 

vices", filed on Mar. 2, 1990. operational status. In the supercritical nuid extractor 

D A i-v^i>/^i TxTri i-iTT Tuc TKrv/c vTTirtM dcscribcd abovc with reference to FIGS. 1-3, for exam- 

BACKGROUND OF THE INVENTION p,^^ ^^^^^^ ^^ange fluid flow, dispense fluids, and 

The present invention relates to methods of creating change valve positions, 

a self-documenting logfile of events which occur during As further understood by those of ordinary skill, most 

the operation of a computer-controlled mechanical devices have a performance standard or other routine 

device, and more specifically, to methods for verifica- against which results are measured. For example, most 

tion and detection of alterations to the self-documenting analytical laboratory testing must conform to Good 

logfile. 20 Laboratory Practices (GLP) and general -laboratory 

Modem advances in computer related technologies record keeping requirements. Typically, these require- 

have provided application programs which allow users ments are satisfied by hand recording data or by manu- 

of mechanical devices to operate the devices via com- ally updating a database containing each operation per- 

puter control. Such computer control has numerous formed by the computer-controlled mechanical device, 

advantages including time savings and a general reduc- 25 problems encountered using these techniques are 

tion m operational error. well known. For instance, potentially valuable informa- 

One example of such an application program is dis- ^^^^ ^^^^ ^e recorded due to a failure to update the 

closed in the above-referenced co-pending patent appli- ^^^^^^ j^^^ ^^^^j^^ ^^^^^ ^j^^ ^ inaccu>ate as a 

cation for image-onented computer control of a super- ^^^j^ ^^^^^^j information incorrectly, or the re- 
cntical fluid extractor _A pantally schematic u^^^^^ 30 ^^^^ database.could be tampered with inadvertently, 

cal fluid extractor is shown m FIG. 1. Typically, the Ti,-,-f«« *t,l« n n ir 

extractor 10 will include the following components: an Th" f° ' IV t . h self-documenting 

analyte trap 12, an extraction chamber 13, extraction ^« ii ' instructions for a 

fluids 14. fluid delivery means 15, fraction output means computer-controlled mechamca device m order to 

16, a keyboard 17, and rinse solvents 18. The extractor 35 ^'^^P^V with standards such as GLP and general labora- 

10 U electrically interfaced to a computer 2 which runs tory record keeping requirements, so that a chronologi- 

the image-oriented extractor applications software. history may be reviewed to venfy the accuracy of 

The image-oriented applications program, in brief. devices operation and to determine whether the 

displays an image depicting the supercritical fluid ex- records may have been affected by accidental or inad- 
tractor on a monitor 8 and accepts instruction inputs 40 vertent erasure or tampcnng attempts, 

from the user pertaining to the desired function to be SUMMARY OF THE INVENTION 
performed, via a keyboard 4 or mouse 6. This input 

triggers the application programs to display status infor- present invention provides methods which fulfill 

mation related to the functional component selected by t^e need for a self-documenting method to record the 
the user. The applications program then permits the 45 status and user instructions for a computer-controlled 

user to modify the extractor's operation or status ac- mechanical device in order to comply With standards 

cordingly. such as GLP and general laboratory record keeping 

Initially, the extractor 10 is displayed on the monitor requirements. More specifically, the claimed methods 
8 as shown in FIG. 2. The user then moves a cursor (not provide a self-documenting logfile which detects errors 
shown) to one of the extractor's functional components 50 in the device's operation and deviations in the status of 
and selects this component by pressing a button on the the device as well as accidental or inadvertent erasure 
mouse. For instance, if the user selects the extraction of the logfile or tampering attempts, 
chamber functional component 13 in FIG. 1, a new The self-documenting logfile records the status and 
screen, depicted in FIG. 3, will be displayed providing operation of a substantially computer-controlled me- 
the user with the extraction chamber status. The user 55 chanical device which has one or more application 
may modify the extraction chamber parameters, for programs. The method for creating the logfile com- 
example by changing the temperature setting 64. This prises accepting input commands from a user for con- 
may be accomplished by moving the cursor to the tern- trolling the status and operation of the device; monitor- 
perature setting 64, pressing a button on the mouse and ing the status and operation of the device; detecting 
entering the desired temperature setting. Alternatively, 60 events which may include deviations in the device sta- 
the user may select the increment arrow 61 or the dec- tus, user input commands, or steps in the operation of 
rement arrow 62, causing the temperature setting 64 to the device; writing these detected events to the logfile 
change by 1* C. in the corresponding direction. together with the date and time at which the detected 

As will be appreciated by those of ordinary skill, for event occurred, thereby creating an event line. The 
the operational status of the mechanical device or its 65 present invention retrieves the logfile upon user de- 

functional components to be accurately displayed, it mand and verifying the user input commands by deter- 

will be necessary that an appropriate sensor be present mining the acceptability of the input commands and 

in the mechanical device. Such sensors detect a given detecting inadvertent alteration to the logfile. In a pre- 



08/26/2003, EAST Version: 1.04.0000 



5,155,693 

3 4 

ferred embodiment, a start up event line is written to the FIG. 6 shows and "Invalid Data" error display, 

logfile in order to indicate which application program FIG. 7 shows a "corrupt line will be truncated" mes- 

has been selected by a user. An error message informs sage display. 

the user if the logfile cannot be created. If the logfile FIG. 8 illustrates a sample logfile documenting an 

cannot be opened during the operation of the applica- 5 example of normal extractor activity with a missing vjal 

tion program, the user is informed of the condition and error. 

must acknowledge the condition so that a new logfile FIG. 9 shows an example of an error display during 

can be created with an alternate start up message indi- extractor activity. 

eating that the application program started at an un- piG. 10 shows an example of a user instruction dis- 

known time and that some event lines may have been 10 piay during extractor activity. 

lost. 

A logfile is tested for validity by examining its con- DETAILED DESCRIPTION OF THE 

tents whether less than a minimum number of charac- INVENTION 

ters have been written to the logfile, whether the start Referring to FIG. 4, a functional flow diagram of the 

up event line is absent from the logfile, whether a maxi- 15 self-documenting logfile software is shown. A mechani- 

mum number of characters have been exceeded in an ^^1 device such as the extraction instrument described 

event line and whether impermissible characters or ^i^ve is substantially controlled by a computer pro- 

non-printablc characters are present in the logfile. If any g^gj^^ referred to as the "application program." Once a 

of these conditions are found then the user is informed ygg^ initiates an application program, shown in FIG. 4 

that the logfile or the data within it is invalid when the 20 ^qq ^^^^ computer creates a file called a logfile at 

logfile is retrieved. . , . . step 102. Once this file has been created, a start up event 

These and other advantages are accomplished by the ^^(^^j, (j^^ ,Qgf-,,g indicating which application 

present invention, which is particularly pointed out in ^ has been selected at step 104. 

the appended claims and is described and illustrated in application program runs, important events 

connection with the accompanying drawings. 25 gurn^arized as a phrase. Important events are typi- 

Methods of providing an enciphenng key w thin the ^j^^^^ associated with the status of the device and 

event hnes which comprise the logfile in order to detect operation of the device. For instance important 

tampenng are also disclosed. Preferab y, an enciphering ^^g^tJ^i^ extraction instrtiment might include "clos- 

key is generated which permits the detection of tamp^^^^ ^^^^^^^ insiniment, one of the 

ing attempts. The enciphenng key is created by modify- 30 J instrument application, 

ing the event lines to have a regular charactenst.c. and P ^ ^^^^ other examples 

the detection of tampenng attempts compnses the step ^^^^ messaees 

of determining if any event lines do not possess the ^ 

regular characteristic. Thus, that each event line may be TABLE 1 

modified, for example, to contain the same number of 35 jderrorm. "Place vial in turrci position 7fd" 
characters, an even number of characters, an odd num- IDERROR70. "Place thimble in extraction chamber" 
ber of characters, or to contain one or more particularly l^E^^S^^! • "traction chamber door- 
selected characters. In a preferred embodiment, the step JglJjJgj;]; Iji;; ^^^^^ 
of modifying the event lines is changed on a regular iderrori 13. "Replace from cover ' 

basis, such as over time or upon the creation of a spe- 40 JDCOMMERRO. "HP7680A fatal erron perform full reset" 

Cific number of lines, to further defeat tampering at- IDCOMMERRl. ••HP7680A received command om of order" 

__ 1 a. jp**. !;t,b IDCOMMERR2. "Invalid parameter detected in command" 

tempts. The resulting enc pherment exists on each line ,pcoMMERR3, -Outside cover not installed" 
and extends across all the lines of the logfile. l his ettec- idcommerR4. -insumdent tank pressure- 
lively renders the entire file enciphered by a key which idcommerrs. "No sample thimble in emraciion chamber- 
is distributed or embedded throughout the file, thus 45 IDCOMMERRS. "Extraction chamber door open- 
making detection of a minute alteration possible, al- 

iimMUfi ucitt..»vii « iii. ... 1 1 IDCOMMERRS. "System pressure low: current lank II %d 

though m this instance the specific sue or particular line idcommerr9. -Cryogenic pressure low" 
on which the modification occurs may not be readily iix:ommerrio, -Circuit board missing- 
determined. IDCOMMERRlt, "Circuit board in wrong slot" 

SQ IDCOMMERRl 2, "Dtspeoser pump broken" 

BRIEF DESCRIPTION OF THE DRAWINGS IDCOMMERR13. "Dispenser mechanism broken" 

, , , IDCOMMERR 14. "Vj»] turret broken" 

The present invention will be better understood, and idcommerris, "Viai needle carnage broken- 
its numerous advantages will become apparent by refer- idcommerru. "Liquid leak detected in base" 
ence to the following detailed description of the inven- idcommerrh. -chamber broken" 
cui,c lilt 6 r f„,i--^;-,_ ,r idcommerris. "System overpressure condilion" 
tion wnen taken m COnjuncuon wun me lunowuig ,dcoMMERR 1 9. -l^rmal control system broken" 
drawings, in which: IDCOMMERR20. '•HP7680A not responding" 

FIG. 1 is a partially schematic, perspective view of an idcommerrji. "Stari ko-press disallowed at this time" 

aoparatus for computer control of a supercritical fluid idcommerR22. ~No iray prwem" 

■ ^ IDC0MMERR23. "System cannot be in a run" 
extractor. j- , ■ ^ IDC0MMERR24, **Chamber is not closed" 

FIG. 2 illustrates a computer screen displaying the 60 idcommerris. -open disallowed; system pressurized" 

functional components of a supercritical fluid extractor. idcommerR26, "Depressunzation timeout" 

FIG 3 illustrates a computer screen displaying status 1DC0MMERR27. -Pressure isoUtion valve malfunction" 

and operational parameters for the extraction chamber IPE?""? ^J??- overpressure coT,dinon" 

*^ .. r« .J IDC0MMERR29, "Pump pressure transducer IS defective 

of a supercritical fluid extractor. 

FIG. 4 is a functional flow diagram of the self-docu- 65 

menting logfile software. The data and time are added to the event to form an 

FIG. 5 is a functional flow diagram of the logfile event line which is written to the logfile at step 106. 

verification procedure during the application. Each subsequent event line is similarly written to the 
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logfile until the application has been completed or ter- 
minated as shown by step 108. 

A series of logfiles are preferably stored on the com- 
puter's hard disk or other storage means. The stored 
logfiles preferably comprise current operations and 
extend backward in time to archive all instrument activ- 
ity within the limits of the available disk space. As well 
known to those skilled in the art, any storage media 
capable of storing computer data, such as magnetic tape 
or floppy disk, could be used instead of hard disk stor- 
age media. At step 110 the current logfile is thus ar- 
chived on any medium capable of storing computer 
data. The logfile is "archived", since it resides on the 
disk from the time it was created at step 102. In pre- 



10 



logfile is created at step 126. The start up event line will 
also be written to the new logfile at step 128. This event 
line will differ from the original event line, not only by 
indicating the application, but also by specifying that 
the application program started at an unknown time and 
that some information may have been lost. Once the 
new start up event line is written to the new logfile, the 
application program may continue and the self-docu- 
menting logfile software continues with step 106 shown 
in FIG. 4. 

When the user chooses to print a logfile, several other 
tests are also preferably performed, as listed in Table 1. 
If the file is unusually small, an error is displayed indi- 
cating that the file is "empty". This determination can 



ferred embodiinents, the logfile is printable from the 15 ^ ^^^^ because a minimum number of characters are 
instrument application programs shown by step 112. 

As shown by the dashed line in FIG. 4, printing of the 
logfile may be performed at any time the application 
program is running. The ability to print at any given 
time is important since the verification procedures de- 20 
scribed below require that the application program is 
running. This would not be true if the only access to the 
print step 112 were through the application termination 
step 108. 



written to the file immediately after creation and fewer 
characters than the minimum number have been found. 

Another test checks the beginning of the logfile for 
the presence of a start up event line indicating which 
application program has been selected. If this text is not 
found, a message is communicated to the user, indicat- 
ing that the file is invalid. Further tests are preferably 
made of the logfile contents when printing the logfile. 



Several tests are performed to detect errors and tarn- 25 'P'*^"^^' ^ search may be made for any non-print- 



pering. Most applications programs are run on an unse- 
cured system, for instance, using the environment of the 
extraction instrument application which is preferably 
based upon Microsoft Corp. WINDOWS tm . The self- 



ing characters, as might arise from inclusion of an exe- 
cutable file. Also, a user could unintentionally rename 
the logfile as an executable file or execution lines could 
inadvertently be appended to the logfile via the user or 



documenting logfile software of the present invention 30 a faulty computer operating system or hardware. Addi- 
detects accidental and inadvertent erasure as well as ' ' -. ^ - - - » t- 

some tampering attempts. Such alterations of the logfile 
are likely to result from the application program's in- 
tended users rather than from unauthorized persons. 



tional tests are made for various special characters, such 
as the "newline", EOF (end of file), null and other 
formatting characters which are known to those skilled 
in the art. Only cenain special characters or combina- 



Error 
ai FIG. 4 



Table 2 presents a summary of the tests used for de- 35 tions of special characters are permitted characters 
tecting errors and tampering of logfiles generated by within the logfile. If a non*prinlable character or imper- 
the extractor instrument application program. missible special characters are found within the logfile, 

TABLE 2 invalid data message is posted for the user, as shown 

in FIG. 6. 

4Q As the logfile is printed, each event line is preferably 
checked for length. An event line is preferably limited 
to a predetermined length; if the number of characters 
within an event line exceeds the maximum allowable 
number of characters, a message is displayed for the 
45 user indicating that the "corrupt line will be truncated." 
An example of this message is shown in FIG. 7. Such a 
situation may arise, for example, from file transcription 
errors. 

As would be readily understood by those of ordinary 
50 skill, a logfile could be retrieved by a user for on-line 
review as one alternative to printing out the logfile for 
review. The same tests are preferably provided for 
on-line review of the logfile. Additionally, other tests 
If a logfile cannot be created at step 102, an error mes- could be provided to verify the validity of the logfile 
sage is sent to the user and the application is terminated. 55 contents, such as testmg the event lines for chronologi- 
Such a situation might occur, for example, when there cal order. 

exists a serious computer system failure or if no disk .Another aspect of the present mvention is the verifi- 
space is available. cation of the logfile contents. The contents of the logfile 

As would be understood by those skilled in the an, is examined to generate an enciphering key, which can 
the logfile must also be opened before each event line is 60 be changed from time to time. This key can be used, for 
written. If the logfile cannot be opened, the procedure example, to subtly modify the contents of successive 
shown in FIG. 5 is executed. As shown, the event line lines in the logfile. When the logfile is retrieved for 
is created at step 120, If the logfile can be opened as verification and printing, alterations are detected with a 
determined by step 122, then the event line is written to known probability. Thus, choice of an appropriate enci- 
thc logfile as described by step 106 in FIG. 4. However, 65 phering algorithm can make the detection of tampering 
if the logfile cannot be opened, an error message is almost a certainty. 

generated and displayed to the user at step 124. After For example, if an unchanging "key" is used that 
the user acknowledges the error at step 125, a new requires all lines to contain an even number of charac- 
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ters, half of the event lines, on average, will fulfill this 
requirement. Those that do not could have an extra 
character inserted or added before entry into logfile. 
When verifying, any line with an odd number of charac- 
ters results from a transcription failure or tampering. 
The naive tampcrer will have a 50% probability of 
entering an even line and succeeding with no effort. 
Minimum effort will show that all valid lines are even 
and the 'key' rendered ineffective. A more effective 
procedure can use a *key' with more than two states, or 
a *key' that changes from time to time, or both. A key 
with more states can be achieved by using other attri- 
butes of the event line, such as the number of characters 
of certain types; the space character and the non-print- 



8 



10 



operating properly. Thus, the present invention will 
find wide applicability beyond the specific instruments 
and computer code described herein. 

Therefore, although the present invention has been 
described and illustrated with reference to specific em- 
bodiments, those skilled in the an will recognize that 
modification and variations may be made without de- 
parting from the principles of the invention as described 
herein above and set forth in the following claims. 

What is claimed is: 

1. A method for maintaining a self-documenting log- 
Hie in a computer said logfile being automatically up- 
dated without intervention by a user and recording 
information indicative of a status of a substantially com- 



ing characters. A fixed 'key' using three character posi- 15 puter-controlled device having one or more application 
tions could defeat more than 90% of naive tampering programs, the method comprising the steps of: 



attempts by rejecting individual lines that have been 
added or altered; deducing such an algorithm would be 
difficult for the novice. 

The event lines created by the present invention con- 20 
tain information that changes considerably from line to 
line. If this changing information is used to modify the 
'key' from time to time, the 'key' represents a moving 
target which is individualized for the entire logfile. This 
extends the verification process from individual lines, 25 
which are passed or rejected, to the entire file. When 
the entire file is enciphered, little intrusion is needed on 
each individual line and a simple, secure, preferably 
secret cipher can be efficiently executed. Naive tamper- 
ing attempts could be detected at a discouragingly high JO 
probability so even those skilled in the art would likely 
direct attempts to compromise the system down easier 
avenues. 

To better understand the present invention, a work- 
ing example is provided to demonstrate the self-docu- 35 
menting logfile procedure during an extraction instru- 
ment application where an error condition involving a 
missing vial exists. Referring to FIG. 8, a sample logfile 
is shown. The start up event line 130 includes the mini- 
mum number of characters 131. The event lines 132 40 
show the application steps taken for an analytical exper- 
iment. The "no vial in turret location 1" message 134, is 
displayed on the user's monitor as shown in FIG. 9. 

The user acknowledges this message by selecting the 
"OK" displayed with the message shown in FIG. 9. The 45 
user then receives the message shown in FIG. 10, which 
is also written to the logfile in event line 136. 

The message directs the user to place a vial in turret 
position 1, after which the user selects the **0K" to 
continue. It should be noted that the "OK" is also writ- 50 
ten to event line 136 so that on review of the logfile it 
can be verified that the user had acknowledged correct- 
ing the missing vial error. The application then contin- 
ues normally, as shown by event lines 138. 

It will be appreciated that the techniques described 55 
above may be readily adapted to provide self-docu- 
menting logfiles in many different types of computer- 
controlled apparatus. The descriptions set forth above 
relate mainly to analytical instruments and the Good 



(a) accepting one or more input commands from a 
user; 

(b) monitoring device characteristics indicative of the 
status of the device; 

(c) detecting an event upon occurrence of at least one 
of: 

<i) a deviation in the device status, 

(ii) a procedural step occurring while the device is 
in operation, 

(iii) a user input in response to said deviation in the 
device status, 

(iv) a user input initiating said deviation in the 
device status, and 

(v) a user input initiating a procedural step while 
the device is in operation; 

(d) writing an indication of the event to said logfile 
together with a record of at least the time and date 
of the event, thereby creating an event line; 

(e) archiving said logfile on to a means for storing 
data; 

(0 retrieving said logfile upon user demand; 

(g) verifying said one or more input commands by 
determining whether the input commands meet an 
acceptability criteria and detecting inadvertent 
alteration of said logfile; and 

(h) formatting the logfile with a start up event line 
before an event line is written to the logfile, the 
start up event line being indicative of an application 
program selected by the user for controlling at 
least one of the device characteristics. 

2. The method of claim 1, further comprising the step 
of informing the user of an error if the creation of said 
logfile fails. 

3. The piethod of claim 1, wherein the step of verify- 
ing the user input and delecting inadvertent alteration 
further comprises a method of testing said logfile for 
validity comprising: 

(a) determining whether a minimum number of char- 
acters are present in the logfile; and 

(b) informing the user that the logfile is substantially 
empty if the minimum number of characters are not 
present in the logfile. 

4. The method of claim 1, wherein the step of verify- 



Laboratory Practice (GLP) associated therewith. 60 ing the user input commands and detecting inadvertent 



Those of skill in the art will realize, however, that any 
computer-controlled instrument can be adapted to uti- 
lize the present invention and such use will be governed 
by appropriate standards which supplement GLP for 
other types of instruments or devices. The present in- 65 
vention provides methods whereby a record of the 
inputs and operating conditions of an instrument are 
recorded and evaluated to determine if the instrument is 



alteration to the logfile further comprises a method of 
testing said logfile for validity comprising: 

(a) verifying that the start up event line is present in 
the logfile; and 

(b) informing the user that the logfile contains invalid 
data if the start up event line is not present, 

5. The method of claim 1, wherein the step of verify- 
ing user input commands and detecting inadvertent 
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alteration to the logfile further comprises a method of 
testing said logfile for validity comprising: 

(a) testing characters within said logfile for impermis- 
sible characters and impermissible combinations of 
characters; and 

(b) informing the user that data within the logfile is 
invalid provided that at least one of the impermissi- 
ble characters and the impermissible combinations 
of characters are present. 

6. The method of claim 1, wherein the step of verify- 
ing the user input commands and delecting inadvenent 
alteration to the logfile further comprises a method of 
testing said logfile for validity comprising: 

(a) determining whether one or more of the charac- 
teristics within the logfile are non-printable charac- 
ters; and 

(b) informing the user that characters within the log- 
file are invalid if non-printable characters are pres- 
ent. 

7. The method of claim 1, further comprising the step 
of storing the retrieved logfile in a form which can be 
printed upon user instruction. 

8. The method of claim 1, wherein the device is a 
supercritical fluid extractor. 

9. The method of claim 1, further comprising the step 
of substantially continuously verifying the presence of 
said logfile during the operation of the application pro- 
gram, wherein the verifying step comprises the steps of: 

(a) opening the logfile and displaying a message in- 
forming the user if said logfile cannot be opened; 

(b) accepting an acknowledgement input from the 
user, the input being indicative of a response to the 

' message that the logfile cannot be opened; and 

(c) creating a new logfile. 

10. The method of claim 9, wherein the new logfile 
comprises an alternate start up event line indicative of 
the application program further comprising information 
indicating that event lines may have been lost. 

11. The method of claim 1, wherein the step of verify- 
ing the user input commands and detecting inadvertent 
alteration to the logfile further comprises a method of 
testing said logfile for validity comprising: 

(a) determining whether a maximum number of char- 45 
acters within each event line is exceeded; and 

(b) informing the user that the event line exceeds the 
maximum number of characters. 

12. The method of claim 11, further comprising the 
steps of storing the retrieved logfile in a form which can 
be printed upon user instruction. 

13. The method of claim 12, further comprising the 
step of truncating the event line during printing if the 
event line exceeds the maximum number of characters. 

14. The method of claim 1, further comprising a 
method of delecting tampering comprising the step of 
generating an enciphering key, whereby said encipher- 
ing key permits the detection of tampering attempts. 

15. The method of claim 14, wherein the step of gen- 
erating an enciphering key comprises modifying the 
event lines to have a regular characteristic, and the 
detection of tampering attempts comprises the step of 
determining if any of the event lines comprising the 
logfile do not possess the regular characteristic. 

16. The method of claim 15, wherein the step of mod- 
ifying the event lines comprises ensuring that each 
event line contains the same number of characters. 
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17. The method of claim 15, wherein the step of mod- 
ifying the event lines comprises ensuring that each 
event line contains an even number of characters. 

18. The method of claim 15, wherein the step of mod- 
ifying the event lines comprises ensuring that each 
event line contains an odd number of characters. 

19. The method of claim 15, wherein the step of mod- 
ifying the event lines comprises ensuring that each 
event line contains one or more particularly selected 
characters. 

20. The method of claim 15, wherein the step of mod- 
ifying the event lines is changed on a regular basis. 

21. A method for maintaining a self-documenting 
logfile in a computer said logfile being automatically 
updated without intervention by a user and recording 
information indicative of a status of a substantially com- 
puter-controlled device having one or more application 
programs, the method comprising the steps of: 

(a) accepting one or more input commands from a 
user; 

(b) monitoring device characteristics indicative of the 
status of the device; 

(c) delecting an event upon occurrence of at least one 
of: 

(i) a deviation in the device status. 

(ii) a procedural step occurring while the device is 
in operation, 

(iii) a user input in response to said deviation in the 
device status, 

(iv) a user input initiating said deviation in the 
device status, and 

(v) a user input initiating a procedural step while 
the device is in operation; 

(d) writing an indication of the event to said logfile 
together with a record of at least the time and date 
of the event, thereby creating an event line; 

(e) archiving said logfile on to a means for storing 
data; 

(0 retrieving said logfile upon user demand; 

(g) verifying said one or more input commands by 
determining: 

(i) whether the input commands meet an accept- 
ability criteria, 

(ii) whether inadvertent alteration to said logfile 
has occurred, and 

(iii) whether said logfile is valid; 

(h) formatting the logfile with a start up event line 
before an event line is written to the logfile, the 
start up event line being indicative of an application 
program selected by the user for controlling at 
least one of the device characteristics; 

(i) informing the user of an error if creation of said 
logfile fails; and 

G) verifying the presence of said logfile while an 
application program is operating, wherein the veri- 
fication comprises: 

(i) opening the logfile and informing the user if said 
logfile cannot be opened; 

(ii) accepting an acknowledgement input from the 
user, the input being indicative of a response to 
the information that the logfile cannot be 
opened; and 

(iii) creating a new logfile, wherein the new logfile 
comprises an alternate start up message indica- 
tive of the application program initiated at an 
unknown time and further indicating that event 
lines may have been lost. 

22. The method of claim 21, wherein the device is a 
supercritical fluid exterior. 



08/26/2003, EAST Version: 1.04.0000' 



